@sap/cds-dk 10.1.1 → 10.2.0

package/node_modules/proxy-addr/HISTORY.md

@@ -1,144 +1,150 @@
-2.0.7 / 2021-05-31
-==================
+2.0.8
+=====
+
+  * Fix [CVE-2026-90711](https://www.cve.org/CVERecord?id=CVE-2026-90711) ([GHSA-jqcg-44mw-7w3h](https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h))
+
+
+2.0.7
+=====
 
   * deps: forwarded@0.2.0
     - Use `req.socket` over deprecated `req.connection`
 
-2.0.6 / 2020-02-24
-==================
+2.0.6
+=====
 
   * deps: ipaddr.js@1.9.1
 
-2.0.5 / 2019-04-16
-==================
+2.0.5
+=====
 
   * deps: ipaddr.js@1.9.0
 
-2.0.4 / 2018-07-26
-==================
+2.0.4
+=====
 
   * deps: ipaddr.js@1.8.0
 
-2.0.3 / 2018-02-19
-==================
+2.0.3
+=====
 
   * deps: ipaddr.js@1.6.0
 
-2.0.2 / 2017-09-24
-==================
+2.0.2
+=====
 
   * deps: forwarded@~0.1.2
     - perf: improve header parsing
     - perf: reduce overhead when no `X-Forwarded-For` header
 
-2.0.1 / 2017-09-10
-==================
+2.0.1
+=====
 
   * deps: forwarded@~0.1.1
     - Fix trimming leading / trailing OWS
     - perf: hoist regular expression
   * deps: ipaddr.js@1.5.2
 
-2.0.0 / 2017-08-08
-==================
+2.0.0
+=====
 
   * Drop support for Node.js below 0.10
 
-1.1.5 / 2017-07-25
-==================
+1.1.5
+=====
 
   * Fix array argument being altered
   * deps: ipaddr.js@1.4.0
 
-1.1.4 / 2017-03-24
-==================
+1.1.4
+=====
 
   * deps: ipaddr.js@1.3.0
 
-1.1.3 / 2017-01-14
-==================
+1.1.3
+=====
 
   * deps: ipaddr.js@1.2.0
 
-1.1.2 / 2016-05-29
-==================
+1.1.2
+=====
 
   * deps: ipaddr.js@1.1.1
     - Fix IPv6-mapped IPv4 validation edge cases
 
-1.1.1 / 2016-05-03
-==================
+1.1.1
+=====
 
   * Fix regression matching mixed versions against multiple subnets
 
-1.1.0 / 2016-05-01
-==================
+1.1.0
+=====
 
   * Fix accepting various invalid netmasks
     - IPv4 netmasks must be contingous
     - IPv6 addresses cannot be used as a netmask
   * deps: ipaddr.js@1.1.0
 
-1.0.10 / 2015-12-09
-===================
+1.0.10
+======
 
   * deps: ipaddr.js@1.0.5
     - Fix regression in `isValid` with non-string arguments
 
-1.0.9 / 2015-12-01
-==================
+1.0.9
+=====
 
   * deps: ipaddr.js@1.0.4
     - Fix accepting some invalid IPv6 addresses
     - Reject CIDRs with negative or overlong masks
   * perf: enable strict mode
 
-1.0.8 / 2015-05-10
-==================
+1.0.8
+=====
 
   * deps: ipaddr.js@1.0.1
 
-1.0.7 / 2015-03-16
-==================
+1.0.7
+=====
 
   * deps: ipaddr.js@0.1.9
     - Fix OOM on certain inputs to `isValid`
 
-1.0.6 / 2015-02-01
-==================
+1.0.6
+=====
 
   * deps: ipaddr.js@0.1.8
 
-1.0.5 / 2015-01-08
-==================
+1.0.5
+=====
 
   * deps: ipaddr.js@0.1.6
 
-1.0.4 / 2014-11-23
-==================
+1.0.4
+=====
 
   * deps: ipaddr.js@0.1.5
     - Fix edge cases with `isValid`
 
-1.0.3 / 2014-09-21
-==================
+1.0.3
+=====
 
   * Use `forwarded` npm module
 
-1.0.2 / 2014-09-18
-==================
+1.0.2
+=====
 
   * Fix a global leak when multiple subnets are trusted
   * Support Node.js 0.6
   * deps: ipaddr.js@0.1.3
 
-1.0.1 / 2014-06-03
-==================
+1.0.1
+=====
 
   * Fix links in npm package
 
-1.0.0 / 2014-05-08
-==================
+1.0.0
+=====
 
   * Add `trust` argument to determine proxy trust on
     * Accepts custom function
@@ -150,12 +156,12 @@
   * Add `proxyaddr.compile` to pre-compile `trust` function
     to make subsequent calls faster
 
-0.0.1 / 2014-05-04
-==================
+0.0.1
+=====
 
   * Fix bad npm publish
 
-0.0.0 / 2014-05-04
-==================
+0.0.0
+=====
 
   * Initial release

package/node_modules/proxy-addr/README.md

@@ -37,7 +37,7 @@ proxyaddr(req, function (addr) { return addr === '127.0.0.1' })
 proxyaddr(req, function (addr, i) { return i < 1 })
 ```
 
-The `trust` arugment may also be a single IP address string or an
+The `trust` argument may also be a single IP address string or an
 array of trusted addresses, as plain IP addresses, CIDR-formatted
 strings, or IP/netmask strings.
 

package/node_modules/proxy-addr/index.js

@@ -256,6 +256,13 @@ function trustMulti (subnets) {
     if (!isip(addr)) return false
 
     var ip = parseip(addr)
+
+    if (ip.kind() === 'ipv6' && ip.isIPv4MappedAddress()) {
+      // Canonicalize IPv4-mapped candidates to IPv4 so a mapped address
+      // cannot bypass the cross-family guard via the same-family path
+      ip = ip.toIPv4Address()
+    }
+
     var ipconv
     var kind = ip.kind()
 
@@ -272,6 +279,12 @@ function trustMulti (subnets) {
           continue
         }
 
+        if (subnetkind !== 'ipv4' && !(subnetrange >= 96 && subnetip.isIPv4MappedAddress())) {
+          // IPv6 subnet only spans IPv4 when it is a mapped subnet whose
+          // prefix covers the ::ffff: marker; otherwise it must not match IPv4
+          continue
+        }
+
         if (!ipconv) {
           // Convert IP to match subnet IP kind
           ipconv = subnetkind === 'ipv4'
@@ -280,6 +293,9 @@ function trustMulti (subnets) {
         }
 
         trusted = ipconv
+      } else if (kind === 'ipv6' && subnetip.isIPv4MappedAddress()) {
+        // A native IPv6 candidate cannot match an IPv4-mapped subnet
+        continue
       }
 
       if (trusted.match(subnetip, subnetrange)) {
@@ -308,6 +324,13 @@ function trustSingle (subnet) {
     if (!isip(addr)) return false
 
     var ip = parseip(addr)
+
+    if (ip.kind() === 'ipv6' && ip.isIPv4MappedAddress()) {
+      // Canonicalize IPv4-mapped candidates to IPv4 so a mapped address
+      // cannot bypass the cross-family guard via the same-family path
+      ip = ip.toIPv4Address()
+    }
+
     var kind = ip.kind()
 
     if (kind !== subnetkind) {
@@ -316,10 +339,19 @@ function trustSingle (subnet) {
         return false
       }
 
+      if (!subnetisipv4 && !(subnetrange >= 96 && subnetip.isIPv4MappedAddress())) {
+        // IPv6 subnet only spans IPv4 when it is a mapped subnet whose
+        // prefix covers the ::ffff: marker; otherwise it must not match IPv4
+        return false
+      }
+
       // Convert IP to match subnet IP kind
       ip = subnetisipv4
         ? ip.toIPv4Address()
         : ip.toIPv4MappedAddress()
+    } else if (kind === 'ipv6' && subnetip.isIPv4MappedAddress()) {
+      // A native IPv6 candidate cannot match an IPv4-mapped subnet
+      return false
     }
 
     return ip.match(subnetip, subnetrange)

package/node_modules/proxy-addr/package.json

@@ -1,7 +1,7 @@
 {
   "name": "proxy-addr",
   "description": "Determine address of proxied request",
-  "version": "2.0.7",
+  "version": "2.0.8",
   "author": "Douglas Christopher Wilson <doug@somethingdoug.com>",
   "license": "MIT",
   "keywords": [
@@ -10,6 +10,10 @@
     "x-forwarded-for"
   ],
   "repository": "jshttp/proxy-addr",
+  "funding": {
+    "type": "opencollective",
+    "url": "https://opencollective.com/express"
+  },
   "dependencies": {
     "forwarded": "0.2.0",
     "ipaddr.js": "1.9.1"
@@ -17,11 +21,11 @@
   "devDependencies": {
     "benchmark": "2.1.4",
     "beautify-benchmark": "0.2.4",
-    "deep-equal": "1.0.1",
+    "deep-equal": "1.1.2",
     "eslint": "7.26.0",
     "eslint-config-standard": "14.1.1",
-    "eslint-plugin-import": "2.23.4",
-    "eslint-plugin-markdown": "2.2.0",
+    "eslint-plugin-import": "2.32.0",
+    "eslint-plugin-markdown": "2.2.1",
     "eslint-plugin-node": "11.1.0",
     "eslint-plugin-promise": "4.3.1",
     "eslint-plugin-standard": "4.1.0",

package/node_modules/qs/.github/THREAT_MODEL.md

@@ -24,7 +24,7 @@ Caller Application → qs.stringify(obj, options) → Stringifying Engine → Ou
 ```
 
 **Trust Boundaries:**
-- **Input string (parse):** May come from untrusted sources (e.g., user input, network requests)
+- **Input string (parse):** May come from untrusted sources (e.g., user input, network requests). `qs` defines its own key grammar, where bracket groups denote nesting, so the parameter names it derives are deliberately not the flat names produced by `URLSearchParams`, `node:querystring`, or a WHATWG-conformant parser. The parsed object, not the raw string, is the only thing a caller should make trust decisions about; see "Interpretation conflict" below.
 - **Input object (stringify):** The calling application's own data, not a direct untrusted channel. May contain cycles (handled by the cycle detector). Deeply-nested non-cyclic input surfaces as a catchable synchronous `RangeError` (stack overflow), not unbounded resource consumption; callers that serialize externally-influenced objects should bound their depth/size beforehand.
 - **Options:** Provided by the caller
 - **Cycle Tracking:** Used only during stringification to detect and handle circular references
@@ -51,6 +51,7 @@ Caller Application → qs.stringify(obj, options) → Stringifying Engine → Ou
 - **Information Disclosure:** Error messages may expose internal details or sensitive data.
 - **Denial of Service:** Large or malformed input can exhaust memory or CPU.
 - **Elevation of Privilege:** Prototype pollution can lead to unintended privilege escalation in the host application[3][4][8].
+- **Interpretation conflict (out of scope):** An application that parses the same query string with two different parsers, and makes a trust decision on one result while consuming the other, can be attacked by any input the two parsers read differently. `qs`'s bracket grammar guarantees such inputs exist, so this is a property of the deployment, not a defect `qs` can remove. It is the calling application's responsibility to parse once and validate the parsed object.
 
 ### 6. Mitigation/Countermeasures
 
@@ -58,8 +59,9 @@ Caller Application → qs.stringify(obj, options) → Stringifying Engine → Ou
 |---------------------------------------------------|---------------------|
 | Tampering (malicious input, prototype pollution)  | Strict input validation; keep `allowPrototypes: false` by default; use `plainObjects` for output; ensure builtins/globals are never modified by parse[4][8]. |
 | Information Disclosure (error messages)           | Generic error messages without stack traces or internal paths. |
-| Denial of Service (memory/CPU exhaustion)         | `arrayLimit`, `parameterLimit`, and depth limiting apply with safe defaults. Note that `arrayLimit` is a representation threshold (array vs. object), and `parameterLimit` bounds only the number of `&`-delimited parameters - neither caps the elements produced by `comma: true` splitting. For a hard cap that rejects oversized untrusted input, opt in to `throwOnLimitExceeded: true` (default `false`), and always bound input size at the transport layer[7]. On the `stringify` side, the input is the caller's own object rather than an untrusted string, so unbounded nesting manifests as a catchable `RangeError` (stack overflow) rather than exhaustion; callers serializing externally-influenced objects should bound depth/size beforehand, and may opt into `stringify`'s `depth` option (default `Infinity`) for a deterministic, catchable error. |
+| Denial of Service (memory/CPU exhaustion)         | `arrayLimit`, `parameterLimit`, and depth limiting apply with safe defaults. Note that `arrayLimit` is a representation threshold (array vs. object), and `parameterLimit` bounds only the number of `&`-delimited parameters - neither caps the elements produced by `comma: true` splitting. For hard caps on the number of parameters and on each array's length, opt in to `throwOnLimitExceeded: true` (default `false`), which rejects a query string with more than `parameterLimit` parameters, or one that would produce any array longer than `arrayLimit`. `arrayLimit` applies to each array separately, including each parameter's comma-split value, so the total number of values can still reach `parameterLimit` times `arrayLimit`; always bound input size at the transport layer as well[7]. On the `stringify` side, the input is the caller's own object rather than an untrusted string, so unbounded nesting manifests as a catchable `RangeError` (stack overflow) rather than exhaustion; callers serializing externally-influenced objects should bound depth/size beforehand, and may opt into `stringify`'s `depth` option (default `Infinity`) for a deterministic, catchable error. |
 | Elevation of Privilege (prototype pollution)      | Keep `allowPrototypes: false`; validate options against allowlist; use `plainObjects` to avoid prototype pollution[4][8]. |
+| Interpretation conflict (validate-then-use across two parsers) | None available inside `qs`, by construction: `qs` and a flat parser disagree about parameter names for well-formed input, so no hardening can make the two views equal. Parse untrusted input once, with `qs`, and apply deny lists, authorization, and signature checks to the parsed object rather than to raw key text. Text that `qs` cannot place in its grammar is currently dropped, so distinct raw names can share one parsed path ([#619](https://github.com/ljharb/qs/issues/619)). |
 
 ### 7. Risk Ranking
 

package/node_modules/qs/CHANGELOG.md

@@ -1,17 +1,41 @@
+## **6.16.1**
+ - [Fix] `parse`: do not mutate an object input
+ - [Fix] `stringify`: stop re-encoding structural separator dots when `encodeDotInKeys` is set (#564)
+ - [Fix] `stringify`: `arrayFormat: 'comma'`: pass the full encoder arguments with `encodeValuesOnly`
+ - [Fix] `utils`: encode `+` as `%2B` in iso-8859-1 mode so values round-trip (#565)
+ - [Fix] parse: only convert top-level dots to brackets when allowDots is on (#621)
+ - [Fix] `stringify`: ignore inherited array format names (#622)
+ - [Fix] `stringify`: `arrayFormat: 'comma'`: do not throw on elements with no callable `toString`
+ - [Fix] `utils`: `merge`: seed an overflow container's index from its own keys, not just the source
+ - [Fix] `utils`: `merge`: keep a `strictMerge` conflict container's index and `arrayLimit` correct
+ - [Fix] `parse`: only treat `[]` as array syntax when it ends the key
+ - [Perf] `decode`: skip decoders when there is no percent sign (#583)
+ - [Robustness] `utils`: `merge`: apply `arrayLimit` to the two-element array built for colliding values
+ - [Robustness] `parse`: bound the nesting added by repeated `strictMerge` conflicts
+ - [Docs] document that `qs` and flat parsers disagree about parameter names
+ - [Docs] clarify that `throwOnLimitExceeded` limits each array, not the total number of values
+ - [Docs] clarify 6.14.1/6.15.2 parse bracket behavior change (#567, #568)
+ - [meta] fix changelog indents
+ - [actions] set least-privilege `cache-mode`
+ - [Tests] `utils`: `decode`: add missing cases
+ - [Tests] `parse`: characterize the `]=` split when an `=` precedes any bracket group (#620)
+ - [Tests] `parse`: `allowDots`: cover stray close brackets before a dot
+ - [Dev Deps] update `@ljharb/eslint-config`, `eslint`, `tape`
+
 ## **6.16.0**
- - [New] `stringify`: add a `depth` option to bound recursion depth (default `Infinity`)
- - [Fix] stringify: serialize Date values when a filter is provided
- - [Fix] `parse`: enforce `arrayLimit` on comma groups under `[]=` when `throwOnLimitExceeded` is set
- - [Fix] `parse`: flatten a collection appended to an overflowed array (#571)
- - [Fix] `utils`: `isBuffer`: do not invoke a non-callable `constructor.isBuffer`
- - [Fix] `stringify`: do not let `allowEmptyArrays` skip cycle detection (or drop own keys) on an empty array with own properties
- - [Fix] `stringify`: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)
- - [Docs] threat model: clarify `stringify` deep-nesting DoS is caller-bounded
- - [Docs] clarify `arrayLimit` is a representation threshold, not an element-count cap
- - [Tests] `parse`: remove a test that pinned `[]=` comma groups escaping `arrayLimit`
- - [Tests] `stringify`: pin current `encodeDotInKeys` separator-dot behavior
- - [Dev Deps] update `@ljharb/eslint-config`, `eslint`
- - [Dev Deps] update `eslint`, `evalmd`
+- [New] `stringify`: add a `depth` option to bound recursion depth (default `Infinity`)
+- [Fix] stringify: serialize Date values when a filter is provided
+- [Fix] `parse`: enforce `arrayLimit` on comma groups under `[]=` when `throwOnLimitExceeded` is set
+- [Fix] `parse`: flatten a collection appended to an overflowed array (#571)
+- [Fix] `utils`: `isBuffer`: do not invoke a non-callable `constructor.isBuffer`
+- [Fix] `stringify`: do not let `allowEmptyArrays` skip cycle detection (or drop own keys) on an empty array with own properties
+- [Fix] `stringify`: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)
+- [Docs] threat model: clarify `stringify` deep-nesting DoS is caller-bounded
+- [Docs] clarify `arrayLimit` is a representation threshold, not an element-count cap
+- [Tests] `parse`: remove a test that pinned `[]=` comma groups escaping `arrayLimit`
+- [Tests] `stringify`: pin current `encodeDotInKeys` separator-dot behavior
+- [Dev Deps] update `@ljharb/eslint-config`, `eslint`
+- [Dev Deps] update `eslint`, `evalmd`
 
 ## **6.15.3**
 - [Fix] `parse`: enforce `throwOnLimitExceeded` for cumulative array growth via `combine`/`merge`
@@ -29,7 +53,7 @@
 - [Fix] `stringify`: use configured `delimiter` after `charsetSentinel` (#555)
 - [Fix] `stringify`: apply `formatter` to encoded key under `strictNullHandling` (#554)
 - [Fix] `stringify`: skip null/undefined filter-array entries instead of crashing in `encoder` (#551)
-- [Fix] `parse`: handle nested bracket groups and add regression tests (#530)
+- [Fix] `parse`: handle nested bracket groups and add regression tests (#530); changes output for some unbalanced bracket keys (see #558)
 - [readme] fix grammar (#550)
 - [Dev Deps] update `@ljharb/eslint-config`
 - [Tests] add regression tests for keys containing percent-encoded bracket text

package/node_modules/qs/README.md

@@ -85,6 +85,23 @@ assert.deepEqual(qs.parse('foo[bar][baz]=foobarbaz'), {
 });
 ```
 
+Since v6.14.1 and v6.15.2, `parse` interprets nested bracket groups more consistently. Query strings with unbalanced `[`/`]` can produce different results than in 6.15.1; see [#558](https://github.com/ljharb/qs/issues/558).
+
+Because of that bracket grammar,
+**qs** does not agree with `URLSearchParams`,
+`node:querystring`, or any other flat parser about what the "name" of a parameter is,
+and it never has.
+`URLSearchParams` reads `'foo[bar]=baz'` as one flat name `foo[bar]`;
+**qs** reads it as the path `foo.bar`.
+Text that **qs**'s grammar cannot place,
+such as the `extra` in `'foo[bar]extra=baz'`,
+is currently dropped, so several distinct flat names can resolve to the same **qs** path
+(see [#619](https://github.com/ljharb/qs/issues/619)).
+
+So validating, authorizing, filtering,
+or signing a query string with one parser and then consuming it with another is unsafe: a deny list or signature computed over `URLSearchParams` names does not constrain what **qs** will produce from the same string.
+Parse the input once, with **qs**, and apply your checks to the resulting object.
+
 By default, when nesting objects **qs** will only parse up to 5 children deep.
 This means if you attempt to parse a string like `'a[b][c][d][e][f][g][h][i]=j'` your resulting object will be:
 
@@ -135,7 +152,7 @@ var limited = qs.parse('a=b&c=d', { parameterLimit: 1 });
 assert.deepEqual(limited, { a: 'b' });
 ```
 
-If you want an error to be thrown whenever the a limit is exceeded (eg, `parameterLimit`, `arrayLimit`), set the `throwOnLimitExceeded` option to `true`. This option will generate a descriptive error if the query string exceeds a configured limit.
+If you want an error to be thrown whenever a limit is exceeded (eg, `parameterLimit`, `arrayLimit`), set the `throwOnLimitExceeded` option to `true`. This option will generate a descriptive error if the query string exceeds a configured limit.
 ```javascript
 try {
     qs.parse('a=1&b=2&c=3&d=4', { parameterLimit: 3, throwOnLimitExceeded: true });
@@ -147,7 +164,7 @@ try {
 
 When `throwOnLimitExceeded` is set to `false` (default), **qs** will parse up to the specified `parameterLimit` and ignore the rest without throwing an error.
 
-Note that `parameterLimit` only bounds the number of `&`-delimited parameters; it does not limit how many values a single parameter expands into. In particular, when `comma: true` is enabled, a single parameter's value is split on commas into arbitrarily many elements, which `parameterLimit` does not constrain. To bound the total element count from untrusted input, set `throwOnLimitExceeded: true` (see `arrayLimit` below), and always bound the input size at the transport layer (e.g. an HTTP body-size limit).
+Note that `parameterLimit` only bounds the number of `&`-delimited parameters; it does not limit how many values a single parameter expands into. In particular, when `comma: true` is enabled, a single parameter's value is split on commas into arbitrarily many elements, which `parameterLimit` does not constrain. Setting `throwOnLimitExceeded: true` (see `arrayLimit` below) makes **qs** reject a query string with more than `parameterLimit` parameters, one that uses an array index of `arrayLimit` or greater, or one that would produce any array longer than `arrayLimit`, including an array produced by comma splitting. `arrayLimit` applies to each array separately, including each parameter's comma-split value, so the total number of values across all parameters can still reach `parameterLimit` times `arrayLimit`, which is 20,000 at the default limits; always bound the input size at the transport layer as well (e.g. an HTTP body-size limit).
 
 To bypass the leading question mark, use `ignoreQueryPrefix`:
 
@@ -293,6 +310,8 @@ assert.deepEqual(withIndexedEmptyString, { a: ['b', '', 'c'] });
 Any array members with an index of `20` or greater will instead be converted to an object with the index as the key.
 This is needed to handle cases when someone sent, for example, `a[999999999]` and it will take significant time to iterate over this huge array.
 
+Since v6.14.1 and v6.15.2, the arrayLimit now applies to arrays specified using both the `[]` and `[0]` syntaxes.
+
 ```javascript
 var withMaxIndex = qs.parse('a[100]=b');
 assert.deepEqual(withMaxIndex, { a: { '100': 'b' } });
@@ -317,7 +336,7 @@ try {
 
 When `throwOnLimitExceeded` is set to `false` (default), **qs** will parse up to the specified `arrayLimit` and if the limit is exceeded, the array will instead be converted to an object with the index as the key.
 
-Note that `arrayLimit` is a *representation* threshold that controls when a numerically-indexed collection switches from an array to an object — it is **not** a hard cap on the total number of elements parsed. With the default `throwOnLimitExceeded: false`, exceeding `arrayLimit` never rejects or truncates input; it only changes the container type, and the resulting object still holds every element (so its size stays proportional to the input). This conversion is itself a safeguard: it avoids allocating a huge sparse array for input like `a[999999999]`. If you need a hard limit that rejects oversized input from untrusted sources, set `throwOnLimitExceeded: true`.
+Note that `arrayLimit` is a *representation* threshold that controls when a numerically-indexed collection switches from an array to an object; it is **not** a hard cap on the total number of elements parsed. With the default `throwOnLimitExceeded: false`, exceeding `arrayLimit` never rejects or truncates input; it only changes the container type, and the resulting object still holds every element (so its size stays proportional to the input). This conversion is itself a safeguard: it avoids allocating a huge sparse array for input like `a[999999999]`. If you need a hard limit that rejects oversized arrays in untrusted query strings, set `throwOnLimitExceeded: true`. `throwOnLimitExceeded` still limits each array separately, not the total: with `comma: true`, each comma-separated group under `a[]=` counts as one element of the outer array, and can itself hold up to `arrayLimit` elements.
 
 To prevent array syntax (`a[]`, `a[0]`) from being parsed as arrays, set `parseArrays` to `false`.
 Note that duplicate keys (e.g. `a=b&a=c`) may still produce arrays when `duplicates` is `'combine'` (the default).
@@ -361,6 +380,15 @@ assert.deepEqual(arraysOfObjects, { a: ['b', 'c'] })
 ```
 (_this cannot convert nested objects, such as `a={b:1},{c:d}`_)
 
+With `[]` or index notation, the values from each comma-separated group stay together as one element of the array, while repeated plain keys flatten into one array:
+```javascript
+var nestedGroups = qs.parse('a[]=b,c&a[]=d', { comma: true });
+assert.deepEqual(nestedGroups, { a: [['b', 'c'], 'd'] });
+
+var flatGroups = qs.parse('a=b,c&a=d', { comma: true });
+assert.deepEqual(flatGroups, { a: ['b', 'c', 'd'] });
+```
+
 ### Parsing primitive/scalar values (numbers, booleans, null, etc)
 
 By default, all values are parsed as strings.